Terraform resource: aws iam policy

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy

aws_iam_policy + aws_iam_role -> aws_iam_role_policy_attachment

Examples

Official example

resource "aws_iam_policy" "policy" {
 name        = "test_policy"
 path        = "/"
 description = "My test policy"

 # Terraform's "jsonencode" function converts a
 # Terraform expression result to valid JSON syntax.
 policy = jsonencode({
   Version = "2012-10-17"
   Statement = [
     {
       Action = [
         "ec2:Describe*",
       ]
       Effect   = "Allow"
       Resource = "*"
     },
   ]
 })
}

Basic example

resource "aws_iam_policy" "your_resource_name" {
  name   = "your_policy_name"
  policy = "${data.aws_iam_policy_document.your_policy_name.json}"
}

DynamoDB example

resource "aws_iam_policy" "dynamodb_example" {
 name = "${var.environment}-dynamodb_example"
 policy = jsonencode({
   Version = "2012-10-17"
   Statement = [
     {
       Action = [
         "dynamodb:Scan",
         "dynamodb:GetItem",
         "dynamodb:BatchGetItem",
         "dynamodb:Query",
         "dynamodb:PutItem",
         "dynamodb:UpdateItem",
         "dynamodb:DeleteItem",
         "dynamodb:BatchWriteItem"
       ]
       Effect   = "Allow"
       Resource = "*"
     },
     {
       Action = [
         "logs:CreateLogGroup",
         "logs:CreateLogStream",
         "logs:PutLogEvents"
       ]
       Effect   = "Allow"
       Resource = "*"
     }
   ]
 })
}

Errors

• Error: Deleting IAM policy ../.. is not authorized to perform: iam:DeletePolicyVersion on resource

Policies

• AWS: Denies access to AWS based on the requested Region

Related

• AWS policy
• aws_iam_user
• Terraform data source: aws_iam_policy_document
• kms:Decrypt
• ecr: ecr:BatchGetImage
• ECS execution policy
• AWS managed policy: AmazonECSTaskExecutionRolePolicy
• s3:
• rds:ResetDBParameterGroup
• IAM JSON policy reference

See also

• Terraform resource: aws_iam_policy, AmazonECSTaskExecutionRolePolicy
• Terraform IAM resources: aws_iam_user, aws_iam_group, aws_iam_role, aws_iam_role_policy_attachment, aws_iam_policy, aws_iam_role_policy, aws_iam_user_policy, aws_iam_user_policy_attachment, aws_iam_access_key, aws_iam_group_policy, aws_iam_group_policy_attachment, aws_iam_openid_connect_provider